CVE Vulnerability Advisory Database

[Affected Scope] GNOME Epiphany browser versions 45.0 through at least 51.x

[Impact] Attackers can bypass permission prompts and access the camera and microphone without user consent, leading to audiovisual confidentiality exposure, if the user approves clipboard or website data access

[Mitigation] Immediately update Epiphany to the patched version containing upstream commit 480c3648

[Affected Scope] All IXP Manager installations prior to version 7.3.0.

[Impact] Authenticated attackers can view or modify API keys belonging to other users, potentially leading to full administrative takeover of the IXP infrastructure.

[Mitigation] Immediately upgrade IXP Manager to version 7.3.0 or later.

[Affected Scope] All versions of Adobe Commerce and Magento Open Source (2.4.7 and earlier)

[Impact] Unauthenticated remote attackers can escalate privileges to gain administrative access and compromise sensitive data

[Mitigation] Apply Adobe security patch APSB26-92 immediately and implement IP whitelisting for the admin panel

[Affected Scope] JFrog Artifactory Self-Hosted versions prior to 7.133.11

[Impact] Low-privileged users can escalate to administrative privileges by exploiting insufficient token scope validation, leading to full system compromise

[Mitigation] Immediately upgrade to version 7.133.11 or later and conduct a comprehensive audit of all existing access tokens

[Affected Scope] WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS prior to v2.25.21.78, and WhatsApp for Mac prior to v2.25.21.78

[Impact] Unrelated attackers can bypass authorization to trigger the processing of arbitrary URL content on target devices, potentially leading to full device compromise when chained with OS-level exploits

[Mitigation] Immediately update WhatsApp and WhatsApp Business to the latest secure versions via the App Store and apply pending Apple OS security patches

[Affected Scope] Adobe Experience Manager (AEM) versions 6.5.23 and earlier (specifically with Forms module and Struts DevMode enabled)

[Impact] Unauthenticated remote attackers can bypass security controls and execute arbitrary system commands or code with system privileges

[Mitigation] Apply the official Adobe APSB25-82 security patch immediately and disable Struts DevMode in production environments

[Affected Scope] Android and embedded devices powered by Qualcomm chipsets utilizing specific GPU micronode firmware

[Impact] Local attackers can execute unauthorized command sequences to bypass security controls, corrupt GPU memory, and achieve local privilege escalation (LPE) to kernel level

[Mitigation] Immediately apply the latest security patches released by Qualcomm and device OEMs, and restrict the installation of untrusted applications

[Affected Scope] Android and embedded devices utilizing Qualcomm Adreno GPU chipsets and associated drivers

[Impact] Local attackers can execute unauthorized commands within the GPU micronode by sending a specific sequence of commands, leading to memory corruption and local privilege escalation (LPE) to kernel level

[Mitigation] Immediately apply the official security patches released by Qualcomm and device OEMs in or after the June 2025 security bulletin

[Affected Scope] Apple iPhone and iPad devices running iOS/iPadOS versions prior to 15.8.4, 16.7.11, 17.7.5, or 18.3.1

[Impact] A physical attacker can disable USB Restricted Mode on a locked device, potentially allowing unauthorized data extraction and forensic access

[Mitigation] Immediately update all affected devices to iOS/iPadOS 15.8.4, 16.7.11, 17.7.5, 18.3.1 or later

[Affected Scope] Oracle Supply Chain - Oracle Agile PLM Framework version 9.3.6 (Software Development Kit, Process Extension component)

[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to gain unauthorized access to critical data or complete access to all accessible data within the framework

[Mitigation] Immediately apply the official security patches provided by Oracle and restrict external HTTP/HTTPS access to the affected system

[Affected Scope] Apache OFBiz versions up to and including 18.12.14

[Impact] Unauthenticated remote attackers can execute arbitrary screen rendering code and system commands by sending specially crafted HTTP requests

[Mitigation] Immediately upgrade Apache OFBiz to the latest stable version 18.12.15 or higher

[Affected Scope] All self-hosted versions of Confluence Data Center and Server. (Atlassian Cloud sites are not affected)

[Impact] Unauthenticated remote attackers can reset Confluence setup states and create unauthorized administrator accounts, leading to a complete compromise of confidentiality, integrity, and availability.

[Mitigation] Immediately upgrade to the latest patched versions or restrict external access to the setup endpoints (/setup/*) via reverse proxy or WAF configurations.

[Affected Scope] Remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software.

[Impact] Improper AAA separation allows unauthenticated remote attackers to conduct brute-force attacks to identify valid credentials or establish unauthorized clientless SSL VPN sessions.

[Mitigation] Apply official software updates from Cisco, or implement workarounds by redirecting default connection profile authentication to a loopback address and enforcing MFA.

[Affected Scope] Ivanti MobileIron Sentry versions 9.18.0 and below with MICS (Mobile IT Connector System) Admin Portal enabled

[Impact] Unauthenticated attackers can bypass authentication controls on the administrative interface, leading to remote code execution (RCE) and full system compromise

[Mitigation] Immediately apply the official vendor patches and restrict external access to the MICS administrative port (default TCP 8443)

[Affected Scope] D-Link DIR-605 B2 Firmware Version 2.01MT and prior

[Impact] Unauthenticated remote attackers can retrieve plaintext administrator credentials by sending a forged POST request to the /getcfg.php page

[Mitigation] Immediately decommission and replace the legacy EOL device, or disable remote WAN management and restrict network access